CVE-2025-30421: Stack-based Buffer Overflow in DrObjectStorage::XML_Serialize() in NI Circuit Design Suite

Vulnerability summary

CVE-2025-30421 is a high (CVSS 8.5) Stack-based Buffer Overflow vulnerability in ni circuit_design_suite. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.2% of scored vulnerabilities.

Timeline

1. 15-05-2025
   PublishedVulnerability first disclosed.
2. 15-05-2025
   Last modifiedVulnerability information updated.

Description

There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.